@aiwg/cli 2026.10.9 → 2026.10.10

package/tools/ralph-external/session-launcher.mjs

@@ -46,7 +46,12 @@ import { sampleWorkerIdentity, sameWorkerIdentity, createWorkerIdentityCapture,
   qualifyWorkerCpuTickRate, sampleWorkerCpuTime, isSafeWorkerGroupTarget } from './process-monitor.mjs';
 import { createWorkerHealthObserver, sampleOwnedWorktreeContent, classifyWorkerHealthFailure } from './lib/worker-health.mjs';
 import { ScopedFailureBreaker, attributeFailureScope } from './lib/consecutive-failure-circuit-breaker.mjs';
+import { assertManagedWorkerLaunch, validateManagedAttempt } from './lib/managed-worker-attempt.mjs';
+export { assertManagedWorkerLaunch } from './lib/managed-worker-attempt.mjs';
 import { buildSessionEnvironment } from './lib/session-environment.mjs';
+import { withWorkerPath, boundedPrivateRead } from './lib/worker-inputs.mjs';
+import { collectWorkerFinal } from './lib/worker-final.mjs';
+import { resolveRetryReference } from './lib/worker-launch-cli.mjs';
 import { launcherRecoveryEvidence, observeLauncherRecoveryOutcome, recordLauncherRecoveryHint } from './lib/launcher-recovery-evidence.mjs';
 export { observeLauncherRecoveryOutcome } from './lib/launcher-recovery-evidence.mjs';
 import { workerNeedsNativeNamespaces, probeWorkerNativeSandbox, nativeSandboxFailure, nativeSandboxProbeMessage, NATIVE_SANDBOX_UNAVAILABLE, checkWorkerDispatch, detectWorkerIsolation, launchIsolatedWorker, getWorkerIsolationStatus, stopWorkerUnit, readUnitControlGroup } from './lib/worker-isolation.mjs';
@@ -94,75 +99,9 @@ const bytesDigest = bytes => `sha256:${createHash('sha256').update(bytes).digest
 export const beneath = (root, filename) => { const r = relative(root, filename); return r === '' || !r.startsWith('..') && !isAbsolute(r); };
 const signalNumberToName = Object.fromEntries(Object.entries(osConstants.signals ?? {}).map(([name, number]) => [number, name]));
 
-/** Resolve the deepest existing ancestor's realpath, then reattach any
- * not-yet-created remainder. A lexical prefix match is not sufficient: a
- * symlinked ancestor of either path can make `beneath()` wrong in either
- * direction, so both sides are resolved before the lexical comparison. */
-async function resolveRealish(target) {
-  const parts = target.split('/').filter(Boolean);
-  for (let i = parts.length; i >= 0; i--) {
-    const candidate = i === 0 ? '/' : `/${parts.slice(0, i).join('/')}`;
-    try {
-      const real = await realpath(candidate);
-      const remainder = parts.slice(i).join('/');
-      return remainder ? join(real, remainder) : real;
-    } catch (error) { if (error.code !== 'ENOENT') throw error; }
-  }
-  return target;
-}
 export async function realBeneath(root, filename) {
-  const [realRoot, realFilename] = await Promise.all([resolveRealish(root), resolveRealish(filename)]);
-  return beneath(realRoot, realFilename);
-}
-
-// Linux directory handles pin each ancestor. O_NOFOLLOW on a pathname alone
-// cannot protect an ancestor that the worker replaces after inspection.
-async function withWorkerPath(filename, operation) {
-  if (!isAbsolute(filename) || filename.includes('\0') || filename.split('/').includes('..')) throw new Error('Invalid worker path');
-  const components = filename.split('/').filter(Boolean);
-  const leaf = components.pop();
-  let directory = await open('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-  try {
-    for (const component of components) {
-      const next = await open(`/proc/self/fd/${directory.fd}/${component}`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-      await directory.close(); directory = next;
-    }
-    return await operation(`/proc/self/fd/${directory.fd}/${leaf ?? '.'}`);
-  } finally { await directory.close(); }
-}
-
-// #2915 review 4 (finding 4): `privateOutput: true` REPAIRS a loose mode
-// (chmod 0600) rather than rejecting it — correct for the worker's own
-// final-output file, which the launcher itself created and is free to
-// re-tighten. `rejectInsecureMode: true` additionally REFUSES a mode other
-// than exactly 0600 instead of repairing it, for evidence this launcher
-// did NOT create moments ago (retry predecessor metadata) — a 0666 file
-// there is itself a signal worth refusing on, not silently normalizing
-// away.
-async function boundedPrivateRead(filename, limit, inspect, privateOutput = false, rejectInsecureMode = false) {
-  if (!await inspect(filename, 'file')) throw new Error('Required worker input is missing');
-  const handle = await withWorkerPath(filename, target => open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK));
-  try {
-    const stat = await handle.stat();
-    if (!stat.isFile() || stat.nlink !== 1 || stat.size > limit) throw new Error('Worker input must be a bounded unaliased regular file');
-    if (privateOutput) {
-      if (stat.uid !== process.getuid()) throw new Error('Worker final must be conductor-owned');
-      if (rejectInsecureMode) {
-        if ((stat.mode & 0o777) !== 0o600) throw new Error('Worker input mode must already be exactly 0600; insecure modes are refused, not repaired');
-      } else {
-        await handle.chmod(0o600);
-      }
-    }
-    const buffer = Buffer.alloc(limit + 1);
-    let length = 0;
-    while (length < buffer.length) {
-      const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
-      if (!bytesRead) break;
-      length += bytesRead;
-    }
-    if (length > limit) throw new Error('Worker input exceeds bound');
-    return buffer.subarray(0, length);
-  } finally { await handle.close(); }
+  const paths = await importImpl(import.meta.url, 'serve/worker-invocation-paths.js');
+  return paths.realBeneath(root, filename);
 }
 
 export async function publishWorkerRecord(runDir, name, value, inspect) {
@@ -330,55 +269,8 @@ function checkDispatchGuard(dispatchGuard) {
   }
 }
 
-/** Execution-time files in the launcher's private directory. Content producers
- * are pure; preview paths remain ${artifact:name}. Workspace locations are a
- * future declaration kind and are refused here. */
-export async function materializeWorkerArtifacts(invocation, runDir) {
-  const artifacts = invocation.artifacts ?? [];
-  if (!Array.isArray(artifacts) || artifacts.length > 16) throw new Error('Worker artifact count exceeds bound');
-  const names = new Set();
-  let total = 0;
-  for (const artifact of artifacts) {
-    if (!artifact || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(artifact.name)
-      || /[^A-Za-z0-9_-]/.test(artifact.name) || names.has(artifact.name) || typeof artifact.content !== 'string'
-      || artifact.location !== undefined && artifact.location !== 'run-directory') throw new Error('Invalid worker artifact declaration');
-    names.add(artifact.name);
-    const size = Buffer.byteLength(artifact.content);
-    total += size;
-    if (size > 1048576 || total > 4194304) throw new Error('Worker artifact bytes exceed bound');
-  }
-  const paths = new Map(artifacts.map(artifact => [artifact.name, join(runDir, `artifact-${artifact.name}`)]));
-  const argv = invocation.argv.map(token => {
-    if (!token.includes('${artifact:')) return token;
-    const match = /^\$\{artifact:([A-Za-z0-9][A-Za-z0-9_-]{0,63})\}$/.exec(token);
-    if (!match || !paths.has(match[1])) throw new Error('Undeclared worker artifact placeholder');
-    return paths.get(match[1]);
-  });
-  const { inspectWorkerPath } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
-  await inspectWorkerPath(runDir, 'directory');
-  const stat = await lstat(runDir);
-  if (stat.uid !== process.getuid() || (stat.mode & 0o077)) throw new Error('Worker artifact directory must be private and owned');
-  const created = [];
-  const cleanup = async () => {
-    const results = await Promise.allSettled(created.map(filename =>
-      withWorkerPath(filename, target => unlink(target)).catch(error => {
-        if (error.code !== 'ENOENT') throw error;
-      })));
-    const failed = results.find(result => result.status === 'rejected');
-    if (failed) throw failed.reason;
-  };
-  try {
-    for (const artifact of artifacts) {
-      const filename = paths.get(artifact.name);
-      const handle = await withWorkerPath(filename, target => open(target,
-        constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600));
-      created.push(filename);
-      try { await handle.writeFile(artifact.content); await handle.sync(); }
-      finally { await handle.close(); }
-    }
-    return { argv, cleanup };
-  } catch (error) { await cleanup(); throw error; }
-}
+import { materializeWorkerArtifacts, WorkerArtifactLifecycle } from './lib/worker-artifacts.mjs';
+export { materializeWorkerArtifacts } from './lib/worker-artifacts.mjs';
 
 const _workerRecoverySubscriptions = new WeakMap();
 const _workerRecoveryReporters = new WeakMap();
@@ -413,45 +305,6 @@ function subscribeWorkerRecovery(owner, breaker) {
   _workerRecoverySubscriptions.set(owner, () => reporter.owners.delete(owner));
 }
 
-/** Reuse the MC authority and its registered one-shot identity at every spawn boundary. */
-export async function assertManagedWorkerLaunch(options, invocation, inputs, projectRoot = process.cwd()) {
-  if (!options.managedAdmission || invocation.mode !== 'managed'
-    || inputs.snapshot.config.parallelism?.worker_mode !== 'managed') throw new Error('Managed worker admission is required');
-  const { createMcAdmissionScheduler } = await importImpl(import.meta.url, 'cli/handlers/mc.js');
-  const { loadLauncherRegistry } = await importImpl(import.meta.url, 'cli/handlers/ralph-launcher.js');
-  const { workerModelKey } = await importImpl(import.meta.url, 'models/provider-policy.js');
-  const scheduler = await createMcAdmissionScheduler(projectRoot, inputs.snapshot.config);
-  const { requestId, generation } = options.managedAdmission;
-  const snapshot = scheduler.snapshot();
-  const record = snapshot.records[requestId];
-  const deadlineAtMs = Math.min(...[record?.accounting?.runKey, record?.accounting?.taskKey]
-    .map(key => snapshot.allowances?.[key]?.deadlineAt).filter(Boolean).map(Date.parse));
-  const registered = loadLauncherRegistry(projectRoot).loops[process.env.RALPH_LOOP_ID];
-  const worker = record?.managed;
-  const reservation = record?.accounting?.reservation;
-  if (!record || record.state !== 'admitted' || record.leaseGeneration !== generation
-    || !record.launchClaimedAt || !record.metadata?.invocationId || Date.parse(record.leaseExpiresAt ?? '') <= Date.now()
-    || deadlineAtMs <= Date.now()
-    || worker?.kind !== 'external' || worker.group !== invocation.selected.group
-    || worker.member !== invocation.selected.member || worker.cli !== invocation.selected.cli
-    || worker.model !== workerModelKey(invocation.selected.inferenceProvider, invocation.selected.model)
-    || reservation?.tokens != null && !(invocation.limits.tokens <= reservation.tokens)
-    || reservation?.costUsd != null && !(invocation.limits.costUsd !== null && invocation.limits.costUsd <= reservation.costUsd)
-    || registered?.managedAdmission?.requestId !== requestId || registered.managedAdmission.generation !== generation
-    || registered.managedWorker?.invocationPath !== options.invocationPath
-    || registered.managedWorker?.runDir !== options.runDir) {
-    throw new Error('Managed worker launch differs from the current claimed admission');
-  }
-  if (record.execution) {
-    const identity = sampleWorkerIdentity(process.pid);
-    if (record.execution.pid !== process.pid || !identity?.bootId || !identity.startTicks
-      || record.execution.startedAt !== `${identity.bootId}:${identity.startTicks}:${identity.uid}`) {
-      throw new Error('Managed worker supervisor identity differs');
-    }
-  }
-  return { ...record, deadlineAtMs };
-}
-
 async function workerDispatchPath(filename) {
   let candidate = filename;
   while (dirname(candidate) !== candidate) {
@@ -491,8 +344,25 @@ function workerLaunchRefusal(outcome) {
 // Neither worker output nor a caller-supplied result can populate this context.
 const directStartupCorrectionContext = new WeakMap();
 
+// Each attempt directory is created exclusively; its parent is the conductor's job.
+async function createAttemptRunDirectory(runDir) {
+  try { await mkdir(runDir, { mode: 0o700 }); } catch (error) {
+    if (error?.code === 'ENOENT') throw new Error(`Worker run directory parent does not exist: ${dirname(runDir)}; create it (mode 0700) before launch`);
+    throw error;
+  }
+}
+
 async function launchOneWorker(owner, options) {
-  const { inspectWorkerPath: inspect, revalidateWorkerInvocationPlan: validate } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
+  const { inspectWorkerPath: inspect, revalidateWorkerInvocationPlan: validatePlan } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
+  // Forward the saved-plan path: invocation identity is verified against it (#2905).
+  const validate = async (plan, snapshot, drivers, now, planPath = options.invocationPath) => {
+    const validateAt = (p, s, d, n) => validatePlan(p, s, d, n, planPath);
+    if (plan.mode !== 'managed' || !options.managedAdmission) return validateAt(plan, snapshot, drivers, now);
+    const checked = await validateManagedAttempt(options, plan, { snapshot, drivers }, now, validateAt,
+      attempt => publishWorkerRecord(dirname(options.invocationPath), `${basename(options.invocationPath)}.attempt.json`, attempt, inspect));
+    options.attempt = checked.attempt;
+    return checked.invocation;
+  };
   const { qualificationDigest } = await importImpl(import.meta.url, 'models/qualification-digest.mjs');
   const planBytes = await boundedPrivateRead(options.invocationPath, 1048576, inspect);
   const saved = JSON.parse(planBytes.toString('utf8'));
@@ -502,9 +372,11 @@ async function launchOneWorker(owner, options) {
   let inputs = await loadInputs();
   const clock = () => typeof options.now === 'function' ? options.now() : options.now ?? new Date().toISOString();
   const now = clock();
-  const invocation = await validate(saved, inputs.snapshot, inputs.drivers, now);
+  const { assertConductorWorkerPlan } = await importImpl(import.meta.url, 'serve/worker-invocation-paths.js');
+  await assertConductorWorkerPlan(saved, options.invocationPath, inputs.drivers);
+  const invocation = await validate(saved, inputs.snapshot, inputs.drivers, now, options.invocationPath);
   if (invocation.mode === 'managed' || options.managedAdmission) {
-    const admitted = await assertManagedWorkerLaunch(options, invocation, inputs);
+    const admitted = await assertManagedWorkerLaunch(options, invocation, inputs, options.projectRoot ?? process.cwd());
     options = { ...options, scopedBreaker: null, managedInvocationId: admitted.metadata.invocationId,
       managedDeadlineAtMs: admitted.deadlineAtMs };
   }
@@ -536,12 +408,12 @@ async function launchOneWorker(owner, options) {
   // check too.
   let verifiedPreviousAttemptId = null;
   if (options?.retryOf !== undefined) {
-    const exitRecord = await verifyRetryPredecessor(options.retryOf,
+    const exitRecord = await verifyRetryPredecessor(await resolveRetryReference(options.retryOf, { inspect }),
       { newInvocationPath: options?.invocationPath, inspect, workerWritableRoots: writableRoots });
     verifiedPreviousAttemptId = exitRecord.invocationId;
   }
-  const paths = { stdout: invocation.stdoutPath, stderr: invocation.stderrPath, final: invocation.finalPath };
-  if (new Set(Object.values(paths)).size !== 3 || Object.values(paths).some(filename =>
+  const paths = (await importImpl(import.meta.url, 'serve/worker-invocation-paths.js')).workerOutputPaths(invocation);
+  if (new Set(Object.values(paths)).size !== Object.keys(paths).length || Object.values(paths).some(filename =>
     filename === options.invocationPath || filename === invocation.briefPath
     || dirname(filename) === runDir && basename(filename).startsWith('artifact-')
     || ['invocation.json', 'process.json', 'exit.json', 'health.json', 'final-evidence.json', 'worker-start.json', 'worker-identity.json', 'worker-exit.json',
@@ -571,7 +443,7 @@ async function launchOneWorker(owner, options) {
   const isolation = invocation.isolation === 'native-sandbox' ? { mode: 'native-sandbox' }
     : options.isolation ?? detectWorkerIsolation();
   if (isolation.mode === 'systemd-unit' && workerNeedsNativeNamespaces(adapter, permissions)) {
-    const probe = await (options.probeNativeSandbox ?? probeWorkerNativeSandbox)({ cwd: invocation.cwd,
+    const probe = await (options.probeNativeSandbox ?? probeWorkerNativeSandbox)({ adapter, cwd: invocation.cwd,
       envNames: invocation.envNames, env: Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
         .map(name => [name, process.env[name]])) });
     if (!probe.ok) throw new WorkerPolicyError(NATIVE_SANDBOX_UNAVAILABLE, nativeSandboxProbeMessage(probe));
@@ -608,7 +480,7 @@ async function launchOneWorker(owner, options) {
   // themselves; pre-spawn refusals above never reach this point. Global
   // dispatch AND per-CLI enablement are checked inside `admitDirectWorker`
   // before any breaker construction (#2915 final review, finding 1).
-  const invocationId = randomUUID();
+  const invocationId = invocation.invocationId ?? randomUUID();
   // #2915 review 4 (finding 8): computed ONCE, before admission, so the
   // SAME digest both gates the allowance reservation here and is published
   // into invocation.json below — never recomputed from a possibly-stale
@@ -718,13 +590,15 @@ async function launchOneWorker(owner, options) {
       throw error;
     }
   }
+  // Created before run-directory preparation so its failure path can report it.
+  const artifactLifecycle = new WorkerArtifactLifecycle(invocation, invocationId);
   // #2915 review 4 (finding 2): this run-directory preparation is
   // pre-spawn work happening AFTER a successful admission above — any
   // failure here (mkdir, ownership, the `.launch-owner` write) must settle
   // the reservation exactly like every other pre-spawn exit, never leak it
   // by throwing before the big try/catch below is reached.
   try {
-    if (!runExists) await mkdir(runDir, { mode: 0o700 }); // exclusive attempt: no recursive creation or reuse
+    if (!runExists) await createAttemptRunDirectory(runDir); // exclusive attempt: no recursive creation or reuse
     const runStat = await lstat(runDir);
     if (runStat.uid !== process.getuid()) throw new Error('Worker run directory must be conductor-owned');
     await withWorkerPath(runDir, async target => { const handle = await open(target, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
@@ -736,6 +610,7 @@ async function launchOneWorker(owner, options) {
     // release without leaving a marker even past the canary deadline.
     await settleLedger({ kind: 'uncertain', confirmedStop: true });
     if (ledgerDiagnostics.length) error.ledgerDiagnostics = ledgerDiagnostics;
+    artifactLifecycle.failure(error);
     throw error;
   }
   const supervisor = sampleWorkerIdentity(process.pid);
@@ -754,6 +629,7 @@ async function launchOneWorker(owner, options) {
   // own outcome.
   let latestProcessRecord = null;
   const publish = (name, value) => {
+    artifactLifecycle.observe(name, value);
     if (name === 'process.json') {
       value = { ...value, recovery: { ...admission.breaker.recoveryStatus(), observedAt: new Date().toISOString() } };
       if (options.startupCorrectionRecord) value.startupCorrection = options.startupCorrectionRecord;
@@ -790,6 +666,7 @@ async function launchOneWorker(owner, options) {
       // task — never from an unverified caller claim.
       previousAttemptId: verifiedPreviousAttemptId,
       requestId: invocationId, taskDigest, role: saved.request.role,
+      ...(options.managedAdmission ? { attempt: options.attempt } : {}),
       selected: invocation.selected, planDigest: qualificationDigest(saved), invocationDigest: qualificationDigest(invocation),
       policyDigest: invocation.policyDigest, catalogDigest: invocation.catalogDigest, profileDigest: invocation.profileDigest,
       expiresAt: invocation.expiresAt, argv: displayArgv, commandDisplay: displayArgv.map(token => JSON.stringify(token)).join(' '),
@@ -813,7 +690,7 @@ async function launchOneWorker(owner, options) {
     }
     // Recheck policy, prompt, installation and exact bindings after file preparation.
     inputs = await loadInputs();
-    await validate(saved, inputs.snapshot, inputs.drivers, clock());
+    await validate(saved, inputs.snapshot, inputs.drivers, clock(), options.invocationPath);
     gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
       paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
     if (!gate.ok) throw workerDispatchRefusal(gate);
@@ -875,6 +752,7 @@ async function launchOneWorker(owner, options) {
     // real child's own queued events (exit/close) race ahead of
     // `captureOneWorker`'s own listener attachment in several tests (and
     // would in production).
+    artifactLifecycle.spawning();
     const launchResult = (options.launchIsolated ?? launchIsolatedWorker)({ name: invocationId,
       command: artifacts.argv[0], args: artifacts.argv.slice(1), cwd: invocation.cwd,
       memoryMaxGb: options.memoryMaxGb ?? 4, gate, config: inputs.snapshot.config, isolation, workerGroup: invocation.selected.group,
@@ -988,6 +866,7 @@ async function launchOneWorker(owner, options) {
       const graceMs = (invocation.health?.terminateGraceSeconds ?? 5) * 1000;
       const { confirmedStop } = await resolveStopEvidence({ isolationMode: outcome.mode,
         unitName: outcome.unit ?? null, child: outcome.child, graceMs });
+      artifactLifecycle.confirmedStop = confirmedStop;
       await settleLedger({ kind: 'uncertain', confirmedStop });
       // #2915 review 6 (finding 3d): when this bounded stop escalation DOES
       // confirm termination, also call the explicit reconciliation -- a
@@ -1005,7 +884,7 @@ async function launchOneWorker(owner, options) {
   } finally {
     admission.breaker.removeListener('transition', onScopeTransition);
     await publishing;
-    try { await artifacts?.cleanup(); } finally {
+    try { await artifactLifecycle.finish(artifacts); } finally {
       // Never chmod a worker-replaced pathname; only the inodes we opened.
       for (const handle of handles) { await handle.chmod(0o600).catch(() => {}); await handle.close().catch(() => {}); }
       await inspect(runDir, 'directory');
@@ -1075,7 +954,7 @@ async function captureOneWorker(owner, ctx) {
   // For systemd-unit mode the unit's MainPID is not known synchronously; it
   // is still resolved once inside observeIdentity.
   let nativeSupervisor = hasTransport && outcome.mode !== 'systemd-unit' ? sampleNativeSupervisor(child.pid) : null;
-  const streams = [handles[0], handles[1], handles[3], handles[4]].map(handle => createWriteStream('', { fd: handle.fd, autoClose: false }));
+  const streams = [handles[0], handles[1], handles[Object.keys(paths).length], handles[Object.keys(paths).length + 1]].map(handle => createWriteStream('', { fd: handle.fd, autoClose: false }));
   let identityObservation = 'pending';
   let reportedWorker = null;
   let output = Buffer.alloc(0);
@@ -1309,26 +1188,10 @@ async function captureOneWorker(owner, ctx) {
     let healthFinalValid = false;
     let healthAttemptFinalValid = false;
     try {
-      const finalStat = await lstat(paths.final);
-      if (!finalStat.isFile() || finalStat.isSymbolicLink() || finalStat.nlink !== 1 || finalStat.size > 262144) throw new Error('Invalid final output');
-      await ctx.inspect(paths.final, 'file');
-      let extracted = false;
-      if (finalStat.size === 0 && driver.extractFinal) {
-        const final = driver.extractFinal(output.toString('utf8'));
-        if (final === null || final === undefined || final.success === false) throw new Error('Missing or unsuccessful final extraction');
-        const bytes = JSON.stringify({ invocationId, source: 'adapter-extraction', candidate: true, verified: false, result: final });
-        if (Buffer.byteLength(bytes) > 262144) throw new Error('Final exceeds bound');
-        await handles[2].writeFile(bytes); extracted = true;
-      }
-      const finalBytes = await boundedPrivateRead(paths.final, 262144, ctx.inspect, true);
-      if (!finalBytes.length) throw new Error('Missing final output');
-      if (!extracted && driver.extractFinal) {
-        const parsed = driver.extractFinal(finalBytes.toString('utf8'));
-        if (parsed === null || parsed === undefined || parsed.success === false) throw new Error('Invalid final output');
-      }
-      await publish('final-evidence.json', { invocationId, path: paths.final, digest: bytesDigest(finalBytes),
-        source: extracted ? 'adapter-extraction' : 'worker-output', candidate: true, verified: false,
-        terminalSuccess: result.exitCode === 0 && !result.timedOut && !result.errorCode });
+      const { finalBytes, extracted, parseFinal } = await collectWorkerFinal({
+        path: paths.final, workdir: invocation.cwd, driver, output, invocationId, result,
+        inspect: ctx.inspect, handle: handles[2], publish, outputFraming: ctx.profile.health?.outputFraming,
+      });
       // Consume #2890's strict final contract when supplied by the installed
       // driver. Legacy extraction remains a candidate, never health authority.
       if (driver.parseWorkerFinal) {
@@ -1336,7 +1199,7 @@ async function captureOneWorker(owner, ctx) {
           // Strict validation consumes original bytes. A legacy extracted
           // object may already have lost duplicate keys and cannot authorize
           // completion through reserialization.
-          const claims = await driver.parseWorkerFinal(extracted ? output : finalBytes, {
+          const claims = await parseFinal(extracted ? output : finalBytes, {
             format: extracted && ctx.profile.health?.outputFraming === 'jsonl' ? 'jsonl' : 'json', observation: { transport: 'shell',
             status: result.exitCode === 0 && !result.errorCode && !result.timedOut ? 'completed' : 'failed',
             termination: result.termination, exitCode: result.exitCode } });
@@ -1601,7 +1464,8 @@ async function captureOneWorker(owner, ctx) {
 //
 // `launchOneWorkerBaseline` and `captureOneWorkerBaseline` reproduce
 // `launchOneWorker`/`captureOneWorker`, apart from the lifecycle fixes above,
-// as they existed at base commit `a4085b86a` (`git show
+// with shared workerClaims/digest validation (#3675) applied to both paths,
+// otherwise as they existed at base commit `a4085b86a` (`git show
 // a4085b86a:tools/ralph-external/session-launcher.mjs`) — before any
 // #2915 direct-recovery code existed in this file. `launchOneWorker`
 // above calls `launchOneWorkerBaseline` for every attempt
@@ -1633,6 +1497,7 @@ async function captureOneWorker(owner, ctx) {
 //     `a4085b86a` called them — with NO `onDispatchCommit` — which that
 //     module's own dual-mode contract (`_runDispatchCommit`) defines as
 //     "behaves exactly as before the hook existed";
+//   - shared final validation (`lib/worker-final.mjs`, #3675);
 //   - unchanged imports (`process-monitor.mjs`, `lib/worker-health.mjs`,
 //     `serve/worker-invocation.js`, `models/qualification-digest.mjs`).
 // Neither function imports, reads, or references the breaker, the
@@ -1647,12 +1512,13 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     loadInputs, validate, inspect, clock, qualificationDigest } = ctx;
   let inputs = ctx.inputs;
   let localGate = gate;
-  if (!runExists) await mkdir(runDir, { mode: 0o700 }); // exclusive attempt: no recursive creation or reuse
+  if (!runExists) await createAttemptRunDirectory(runDir); // exclusive attempt: no recursive creation or reuse
   const runStat = await lstat(runDir);
   if (runStat.uid !== process.getuid()) throw new Error('Worker run directory must be conductor-owned');
   await withWorkerPath(runDir, async target => { const handle = await open(target, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
     try { await handle.chmod(0o700); } finally { await handle.close(); } });
-  const invocationId = options.managedAdmission ? options.managedInvocationId : randomUUID();
+  const invocationId = invocation.invocationId ?? (options.managedAdmission ? options.managedInvocationId : randomUUID());
+  if (options.managedAdmission && invocationId !== options.managedInvocationId) throw new Error('Worker artifact invocation id differs from managed admission');
   const reservation = await withWorkerPath(join(runDir, '.launch-owner'), target => open(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600));
   try { await reservation.writeFile(invocationId); await reservation.sync(); } finally { await reservation.close(); }
   const supervisor = sampleWorkerIdentity(process.pid);
@@ -1664,7 +1530,9 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
   const writeRecord = options.publishRecord ?? publishWorkerRecord;
   const publishFailures = [];
   let publishing = Promise.resolve();
+  const artifactLifecycle = new WorkerArtifactLifecycle(invocation, invocationId);
   const publish = (name, value) => {
+    artifactLifecycle.observe(name, value);
     const write = publishing.catch(() => {}).then(() => writeRecord(runDir, name, value, inspect));
     publishing = write.catch(error => { publishFailures.push({ name, error: error?.message ?? String(error) }); });
     return write;
@@ -1678,6 +1546,7 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     const displayArgv = artifacts.argv.map((token, i) => i === 0 ? token : `<argument:${bytesDigest(token)}>`);
     await publish('invocation.json', { version: 1, origin: 'launcher', invocationId, attemptId: invocationId,
       previousAttemptId: verifiedPreviousAttemptId ?? null, requestId: options.managedAdmission?.requestId ?? invocationId, taskDigest: qualificationDigest(saved.request), role: saved.request.role,
+      ...(options.managedAdmission ? { attempt: options.attempt } : {}),
       selected: invocation.selected, planDigest: qualificationDigest(saved), invocationDigest: qualificationDigest(invocation),
       policyDigest: invocation.policyDigest, catalogDigest: invocation.catalogDigest, profileDigest: invocation.profileDigest,
       expiresAt: invocation.expiresAt, argv: displayArgv, commandDisplay: displayArgv.map(token => JSON.stringify(token)).join(' '),
@@ -1701,7 +1570,7 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     }
     // Recheck policy, prompt, installation and exact bindings after file preparation.
     inputs = await loadInputs();
-    await validate(saved, inputs.snapshot, inputs.drivers, clock());
+    await validate(saved, inputs.snapshot, inputs.drivers, clock(), options.invocationPath);
     localGate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
       paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
     if (!localGate.ok) throw workerDispatchRefusal(localGate);
@@ -1718,13 +1587,14 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     // gated path's own test doubles, not a behavior this branch adds):
     // `await`ing a value that was never a Promise resolves to that exact
     // value with no observable difference.
+    artifactLifecycle.spawning();
     const launchResult = (options.launchIsolated ?? launchIsolatedWorker)({ name: invocationId,
       command: artifacts.argv[0], args: artifacts.argv.slice(1), cwd: invocation.cwd,
       memoryMaxGb: options.memoryMaxGb ?? 4, gate: localGate, config: inputs.snapshot.config, isolation,
       workerGroup: invocation.selected.group,
       allowDegraded: !!options.allowDegraded, attached: true, ownedGroup: true,
       ...(options.managedAdmission ? { onDispatchCommit: async () => {
-        const admitted = await assertManagedWorkerLaunch(options, invocation, inputs);
+        const admitted = await assertManagedWorkerLaunch(options, invocation, inputs, options.projectRoot ?? process.cwd());
         options.managedDeadlineAtMs = Math.min(options.managedDeadlineAtMs, admitted.deadlineAtMs);
       } } : {}),
       ...(options.managedAdmission ? { onSpawnAttempt: () => { managedSpawnAttempted = true; } } : {}),
@@ -1739,9 +1609,10 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
       ...(options.managedAdmission ? { managedAdmission: options.managedAdmission } : {}),
       endedAt: new Date().toISOString(), isolation: isolation.mode, termination: managedSpawnAttempted ? 'uncertain' : 'confirmed',
       descendants: managedSpawnAttempted ? 'unknown' : 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
+    artifactLifecycle.failure(error);
     throw error;
   } finally {
-    try { await artifacts?.cleanup(); } finally {
+    try { await artifactLifecycle.finish(artifacts); } finally {
       // Never chmod a worker-replaced pathname; only the inodes we opened.
       for (const handle of handles) { await handle.chmod(0o600).catch(() => {}); await handle.close().catch(() => {}); }
       await inspect(runDir, 'directory');
@@ -1761,7 +1632,7 @@ async function captureOneWorkerBaseline(owner, ctx) {
   let identity = immediate?.pid === child.pid && immediate?.pid === immediate?.pgid
     && immediate?.uid === process.getuid?.() && immediate?.parentPid === process.pid ? immediate : null;
   let nativeSupervisor = hasTransport && outcome.mode !== 'systemd-unit' ? sampleNativeSupervisor(child.pid) : null;
-  const streams = [handles[0], handles[1], handles[3], handles[4]].map(handle => createWriteStream('', { fd: handle.fd, autoClose: false }));
+  const streams = [handles[0], handles[1], handles[Object.keys(paths).length], handles[Object.keys(paths).length + 1]].map(handle => createWriteStream('', { fd: handle.fd, autoClose: false }));
   let identityObservation = 'pending';
   let reportedWorker = null;
   let output = Buffer.alloc(0);
@@ -1944,29 +1815,13 @@ async function captureOneWorkerBaseline(owner, ctx) {
       publishFailures: ctx.publishFailures?.length ? ctx.publishFailures.slice() : null };
     let healthFinalValid = false;
     try {
-      const finalStat = await lstat(paths.final);
-      if (!finalStat.isFile() || finalStat.isSymbolicLink() || finalStat.nlink !== 1 || finalStat.size > 262144) throw new Error('Invalid final output');
-      await ctx.inspect(paths.final, 'file');
-      let extracted = false;
-      if (finalStat.size === 0 && driver.extractFinal) {
-        const final = driver.extractFinal(output.toString('utf8'));
-        if (final === null || final === undefined || final.success === false) throw new Error('Missing or unsuccessful final extraction');
-        const bytes = JSON.stringify({ invocationId, source: 'adapter-extraction', candidate: true, verified: false, result: final });
-        if (Buffer.byteLength(bytes) > 262144) throw new Error('Final exceeds bound');
-        await handles[2].writeFile(bytes); extracted = true;
-      }
-      const finalBytes = await boundedPrivateRead(paths.final, 262144, ctx.inspect, true);
-      if (!finalBytes.length) throw new Error('Missing final output');
-      if (!extracted && driver.extractFinal) {
-        const parsed = driver.extractFinal(finalBytes.toString('utf8'));
-        if (parsed === null || parsed === undefined || parsed.success === false) throw new Error('Invalid final output');
-      }
-      await publish('final-evidence.json', { invocationId, path: paths.final, digest: bytesDigest(finalBytes),
-        source: extracted ? 'adapter-extraction' : 'worker-output', candidate: true, verified: false,
-        terminalSuccess: result.exitCode === 0 && !result.timedOut && !result.errorCode });
+      const { finalBytes, extracted, parseFinal } = await collectWorkerFinal({
+        path: paths.final, workdir: invocation.cwd, driver, output, invocationId, result,
+        inspect: ctx.inspect, handle: handles[2], publish, outputFraming: ctx.profile.health?.outputFraming,
+      });
       if (driver.parseWorkerFinal) {
         try {
-          await driver.parseWorkerFinal(extracted ? output : finalBytes, {
+          await parseFinal(extracted ? output : finalBytes, {
             format: extracted && ctx.profile.health?.outputFraming === 'jsonl' ? 'jsonl' : 'json', observation: { transport: 'shell',
             status: result.exitCode === 0 && !result.errorCode && !result.timedOut ? 'completed' : 'failed',
             termination: result.termination, exitCode: result.exitCode } });
@@ -4272,6 +4127,7 @@ export class SessionLauncher extends EventEmitter {
             prompt: options.prompt,
             // AIWG's tracking UUID is not an OMP native session to resume.
             sessionId: this.providerAdapter.getName() === 'omp' ? options.resumeSession : options.sessionId,
+            resumeSession: options.resumeSession,
             model: options.model,
             budget: options.budget,
             maxTurns: options.maxTurns,